An insurance company wants to use NHS patient data for their machine learning algorithms to

determine the likelihood of prospective customers acquiring a disease and adjusting the insurance policy
accordingly. Identify the applicable legal principles and any issues or gaps arising from such application
of AI-based technology in the existing legal framework.

It is true that the use of AI applied to patient data by the NHS can bring great benefits such as
cost reduction, early diagnosis, prevention and proper treatment of chronic diseases.
On the one hand, it is a good opportunity for patients, with certain information, to face a plan
of preventive action. At the governmental level, on the other, it will allow analysing
population-scale health factors.
However, such information in the hands of insurance companies that intend to adjust the
policy accordingly, not only would undermine the principle of non-discrimination, but would
not be compatible with some of the principles contained in the General Data Protection
Regulation (GDPR), Data Protection Act 2018 (DPA) and Code of Conduct for data-driven
health.
Recital 54 of the GDPR states on the processing of special categories of personal data that
‘such processing of data concerning health for reasons of public interest should not result in
personal data being processed for other purposes by third parties such as employers or
insurance or banking companies’.1
If the data subject gave explicit consent for the insurance company to process their data
according to Article 9.2.(a) of the GDPR then the latter could count on said information.
However, it seems unlikely that the subject will do it if that means paying a more expensive
policy.

1
‘Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection
of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such, and
Repealing Directive 95/46/EC (GDPR)’